Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 22:39

General

  • Target

    05db5873ac698ff744b9378fc176fed2.dll

  • Size

    231KB

  • MD5

    05db5873ac698ff744b9378fc176fed2

  • SHA1

    bd405be67ce5006d4dffa957d90f0303c65cc795

  • SHA256

    dcdcbee43842a2b872e14131b9e99ae69faa3853cdee24ffbf62d0a6fc4eaef7

  • SHA512

    c872016fc1e36ddddacf53f1a2a59e75aa2b4c99e20f09965f58379e07d5732023f552727a1973167a789def0ad283fc537f46958b7cc74340fdced114a73174

  • SSDEEP

    3072:zysX0WxnWd/IkmL+PViEbmzwtz/wk8YWbH:mskd/IkmuVfyWdMH

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\05db5873ac698ff744b9378fc176fed2.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\05db5873ac698ff744b9378fc176fed2.dll,#1
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ndewq.dll

    Filesize

    225B

    MD5

    c729acf69a86e0d1c950f519caf5073c

    SHA1

    92963c6862b3613f4a5c8a31a1d525383ee303e8

    SHA256

    2528cd14de6df207915efb47550d3dc97f62e6fde60d72bcce895714ef78bacf

    SHA512

    08e981e5a9559f5476f26a6109c4e1ea3fa56d280b7254f03ddb40a2d79cce98d0c81689a8b0f94bc8555948bca8368ab280c23584ec2835fb5197c85712efac

  • C:\Windows\SysWOW64\ndewq.dll

    Filesize

    18KB

    MD5

    7df53153b1f0e2f4bc05535413d3e732

    SHA1

    3196ca4607126d7e834b894b97762d850498f16e

    SHA256

    88ee1c189e0d0655391f282f8ec7b6650d42797a991e6c5e3efe10ac83af4dd5

    SHA512

    e269508e78d6a296485614a7bd4f0fb73004102bf118fad9d137e4ba42d894a9ac0e0be78e197219ca982a33abe0f77ce3f619f1f7a8d8f25e567335dbf5aee4

  • memory/1592-8-0x00000000754A0000-0x000000007551A000-memory.dmp

    Filesize

    488KB

  • memory/1592-1-0x0000000000690000-0x00000000006D3000-memory.dmp

    Filesize

    268KB

  • memory/1592-0-0x0000000000690000-0x00000000006D3000-memory.dmp

    Filesize

    268KB

  • memory/1592-12-0x00000000754A0000-0x000000007551A000-memory.dmp

    Filesize

    488KB

  • memory/1592-11-0x0000000000690000-0x00000000006D3000-memory.dmp

    Filesize

    268KB